Size | 73.9KB |
---|---|
Type | Zip archive data, at least v2.0 to extract, compression method=deflate |
MD5 | 1e1265d35c4534067cfe1c91f5e9eab4 |
SHA1 | 636bbd7b9f399430dc90981ce9de57f1bb8658c9 |
SHA256 | a35dac6b20e8e3233a7f11cb49cce33c118a20d0cf9fb4f54640094621a2e125 |
SHA512 |
650c8249747621dc7957fef9f4d4e22a6ce27b536b6b1fb4872a8409331c57b1c0a109cfbc1d92db781845841c632e78cbffd955402e1eb918eecb375ef082d8
|
CRC32 | 1752AD88 |
ssdeep | None |
Yara | None matched |
This file is very suspicious, with a score of 10 out of 10!
Please notice: The scoring system is currently still in development and should be considered an alpha feature.
Expecting different results? Send us this analysis and we will inspect it. Click here
Category | Started | Completed | Duration | Routing | Logs |
---|---|---|---|---|---|
FILE | March 22, 2025, 4:05 a.m. | March 22, 2025, 4:05 a.m. | 25 seconds | internet |
Show Analyzer Log Show Cuckoo Log |
2025-03-22 04:04:57,004 [root] DEBUG: Starting analyzer from: /tmp/tmpYgXves 2025-03-22 04:04:57,004 [root] DEBUG: Storing results at: /tmp/EDETyelG 2025-03-22 04:04:57,006 [root] ERROR: Traceback (most recent call last): File "/tmp/tmpYgXves/analyzer.py", line 340, in <module> success = analyzer.run() File "/tmp/tmpYgXves/analyzer.py", line 129, in run self.config.file_name, **kwargs) File "/tmp/tmpYgXves/lib/core/packages.py", line 42, in choose_package_class "exist.".format(name)) Exception: Unable to import package "7z": it does not exist. Traceback (most recent call last): File "/tmp/tmpYgXves/analyzer.py", line 340, in <module> success = analyzer.run() File "/tmp/tmpYgXves/analyzer.py", line 129, in run self.config.file_name, **kwargs) File "/tmp/tmpYgXves/lib/core/packages.py", line 42, in choose_package_class "exist.".format(name)) Exception: Unable to import package "7z": it does not exist.
2025-03-22 04:05:12,994 [cuckoo.core.scheduler] INFO: Task #6144550: acquired machine Ubuntu1904x643 (label=Ubuntu1904x643) 2025-03-22 04:05:12,995 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.103 for task #6144550 2025-03-22 04:05:13,321 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1851166 (interface=vboxnet0, host=192.168.168.103) 2025-03-22 04:05:13,325 [androguard.apk] WARNING: Missing AndroidManifest.xml. Is this an APK file? 2025-03-22 04:05:13,352 [cuckoo.machinery.virtualbox] DEBUG: Starting vm Ubuntu1904x643 2025-03-22 04:05:13,882 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine Ubuntu1904x643 to Snapshot 2025-03-22 04:05:20,538 [cuckoo.core.guest] INFO: Starting analysis #6144550 on guest (id=Ubuntu1904x643, ip=192.168.168.103) 2025-03-22 04:05:21,544 [cuckoo.core.guest] DEBUG: Ubuntu1904x643: not ready yet 2025-03-22 04:05:26,567 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=Ubuntu1904x643, ip=192.168.168.103) 2025-03-22 04:05:26,594 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=Ubuntu1904x643, ip=192.168.168.103, monitor=latest, size=73219) 2025-03-22 04:05:26,815 [cuckoo.core.resultserver] DEBUG: Task #6144550: live log analysis.log initialized. 2025-03-22 04:05:29,710 [cuckoo.core.guest] INFO: Ubuntu1904x643: analysis completed successfully 2025-03-22 04:05:29,723 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks 2025-03-22 04:05:29,747 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer 2025-03-22 04:05:30,664 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label Ubuntu1904x643 to path /srv/cuckoo/cwd/storage/analyses/6144550/memory.dmp 2025-03-22 04:05:30,666 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm Ubuntu1904x643 2025-03-22 04:05:38,215 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.103 for task #6144550 2025-03-22 04:05:38,513 [cuckoo.core.scheduler] DEBUG: Released database task #6144550 2025-03-22 04:05:38,530 [cuckoo.core.scheduler] INFO: Task #6144550: analysis procedure completed
G Data Antivirus (Windows) | Virus: Formulas.Vita.13 (Engine A) |
Avast Core Security (Linux) | Script:SNH-gen [Drp] |
Trellix (Linux) | X97M/Downloader.hk trojan |
WithSecure (Linux) | Malware.XF/XAgent.A |
eScan Antivirus (Linux) | Formulas.Vita.13(DB) |
ESET Security (Windows) | DOC/TrojanDownloader.Agent.CWN trojan |
Sophos Anti-Virus (Linux) | Mal/Generic-S |
Bitdefender Antivirus (Linux) | Formulas.Vita.13 |
Emsisoft Commandline Scanner (Windows) | Formulas.Vita.13 (B) |
McAfee | X97M/Downloader.hk |
BitDefender | Trojan.Vita.13 |
Arcabit | Trojan.Vita.13 |
Cyren | XLSM/Sneaky.T.gen!Camelot |
ESET-NOD32 | DOC/TrojanDownloader.Agent.CWN |
Avast | SNH:Script [Dropper] |
Kaspersky | HEUR:Trojan-Downloader.MSOffice.ZLoader.gen |
MicroWorld-eScan | Trojan.Vita.13 |
Emsisoft | Trojan.Vita.13 (B) |
McAfee-GW-Edition | X97M/Downloader.hk |
FireEye | Trojan.Vita.13 |
Ikarus | Trojan.Office.Doc |
Avira | XF/XAgent.A |
MAX | malware (ai score=80) |
Microsoft | TrojanDownloader:O97M/Ursnif.RVA!MTB |
GData | Trojan.Vita.13 |
AhnLab-V3 | XLS/Agent |
Zoner | Probably Heur.W97ShellM |
Tencent | Trojan.Win32.Macro40.11000270 |
Fortinet | MSExcel/Sneaky.T!tr |
AVG | SNH:Script [Dropper] |
Qihoo-360 | macro.office.07defname.gen |
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action | VT | Location |
---|---|---|---|---|
No hosts contacted. |